C-2414 Access Control Systems
Revision 24-3; Effective Sept. 1, 2024
All Programs
Access control systems such as badge readers, smart cards or biometrics, that provide the capability to audit access control attempts must maintain access control logs with successful and failed access attempts to secured areas containing FTI or systems that process FTI. Management must review access control logs monthly. Access control logs must contain the following information for each access request:
the name of the access control device owner;
the success or failure of the access request; and
the date and time of the access request.